Re: [WebDNA] Stop hacking
This WebDNA talk-list message is from 2013
It keeps the original formatting.
numero = 110689
interpreted = N
texte = --001a11c29b4479074804e625bd55 Content-Type: text/plain; charset=ISO-8859-1 > Many of us placed other code to prevent this hole in the webdna pre-parse script. Can you send it to me or post here? On Wed, Sep 11, 2013 at 6:57 PM, John Butler
wrote: > yes, it seems the coder was preventing the very thing I mentioned in my > last post on this thread. > > -G > > > On 2013-09-11, at 7:54 PM, Steve Graham wrote: > > This is noHack.db: > > contextName > ! > addfields > addlineitem > append > appendfile > applescript > arrayget > arrayset > authenticate > boldwords > browsername > calcfilecrc32 > capitalize > case > clearlineitems > closedatabase > command > commitdatabase > convertchars > convertwords > copyfile > copyfolder > countchars > countwords > createfolder > date > ddeconnect > ddesend > decrypt > delete > deletefile > deletefolder > dos > elapsedtime > else > encrypt > exclusivelock > filecompare > fileinfo > findstring > flushcache > flushdatabases > format > format > formvariables > founditems > freememory > function > getchars > getcookie > getmimeheader > grep > hideif > html1 > html2 > html3 > httpmethod > if > include > input > interpret > ipaddress > issecureclient > lastautonumner > lastrandom > lineitems > listchars > listcookies > listdatabases > listfields > listfiles > listmimeheaders > listpath > listvariables > listwords > lookup > lookup > loop > lowercase > math > middle > movefile > object > orderfile > password > platform > product > protect > purchase > random > raw > redirect > referrer > removehtml > removelineitem > replace > replacefounditems > return > returnraw > scope > search > sendmail > setcookie > setheader > setlineitem > setmimeheader > shell > showif > shownext > spawn > sql > sql > sqlconnect > sqldisconnect > sqlexecute > sqlinfo > sqlrelease > sqlresult > switch > table > tcpconnect > tcpsend > text > then > thisurl > time > unurl > uppercase > url > username > validcard > version > version > waitforfile > writefile > xmlnode > xmlnodes > xmlnodesattributes > xmlparse > xsl > xslt > > > On Wed, Sep 11, 2013 at 6:42 PM, Donovan Brooke wrote: > >> Steve, >> It appears the original coder was trying to stop anyone from trying a >> context in the URL... however, I'm not sure why that would be desired. We >> don't know the contents of "noHack.db" so we can't tell you exactly what >> the coder was trying to protect the site from. >> >> Donovan >> >> >> >> --- Original message --- >> *Subject:* [WebDNA] Stop hacking >> *From:* Steve Graham >> *To:* >> *Date:* Wednesday, 11/09/2013 3:53 PM >> >> I found this code in a webdna site I am fixing. Someone please say if >> this is necessary or recommended to stop hackers in v7.x or v6.2.1: >> >> [formvariables] >> [search db=noHack.db&eqcontextNamedatarq=[url][name][/url]] >> [founditems] >> [redirect /] >> [/founditems] >> [/search] >> [/formvariables] >> >> [!] include this file at the top of every page to block hacking when a >> context name appears as a formvariable name [/!] >> --------------------------------------------------------- This message is >> sent to you because you are subscribed to the mailing list < >> talk@webdna.us>. To unsubscribe, E-mail to: archives: >> http://mail.webdna.us/list/talk@webdna.us Bug Reporting: >> support@webdna.us >> >> >> --------------------------------------------------------- This message >> is sent to you because you are subscribed to the mailing list **. To >> unsubscribe, E-mail to: ** archives: >> http://mail.webdna.us/list/talk@webdna.us Bug Reporting: >> support@webdna.us > > > --------------------------------------------------------- This message is > sent to you because you are subscribed to the mailing list **. To > unsubscribe, E-mail to: ** archives: > http://mail.webdna.us/list/talk@webdna.us Bug Reporting: support@webdna.us > **** > > > --------------------------------------------------------- This message is > sent to you because you are subscribed to the mailing list **. To > unsubscribe, E-mail to: ** archives: > http://mail.webdna.us/list/talk@webdna.us Bug Reporting: support@webdna.us > --001a11c29b4479074804e625bd55 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable > Many of us placed other code to prevent this hol= e in the webdna pre-parse script.
Can you send it to me or pos= t here?
--001a11c29b4479074804e625bd55--
Associated Messages, from the most recent to the oldest: